← xiaoai-bridge@1.3.7

Propose a patch

A fix the maintainer can act on, with the evidence attached. It opens under your GitHub account in your browser; KillerSkills holds no token and never modifies the package. The fix is verified the only way we verify anything: the next crawl re-runs the new version in the honeypot. 54 · Caution

Evidence

The sandbox observed nothing beyond the static findings; the proposal cites those.

Diff · removes 27 caught lines

Download .patch
diff --git a/scripts/lib/state.js b/scripts/lib/state.js
--- a/scripts/lib/state.js
+++ b/scripts/lib/state.js
@@ -4,1 +4,0 @@
-* 背景：上游 `@mi-gpt/[email protected]` 在登录成功后把包含 passToken / serviceToken /
@@ -1120,1 +1119,0 @@
-* 环境变量文件（含 passToken）的权限检查与尽力收紧。
@@ -1142,1 +1140,0 @@
-`⚠️  环境变量文件是符号链接：${target}。请确认链接目标仅当前用户可读（chmod 600），否则 passToken 可能泄露。`,
@@ -1168,1 +1165,0 @@
-`⚠️  环境变量文件权限过宽（${formatMode(stats.mode)}）：${target}，passToken 可被同组或其他用户读取。正在收紧为 0600。`,
@@ -1259,1 +1255,0 @@
-if (/"(passToken|serviceToken|ssecurity)"/.test(raw)) {
diff --git a/scripts/xiaoai-listen.js b/scripts/xiaoai-listen.js
--- a/scripts/xiaoai-listen.js
+++ b/scripts/xiaoai-listen.js
@@ -11,1 +11,0 @@
-*   node xiaoai-listen.js clean          清理本地会话缓存（含 passToken）
@@ -44,1 +43,0 @@
-// 在加载凭据之前先安装脱敏，避免 passToken/serviceToken 进入 stderr。
@@ -144,1 +142,0 @@
-"登录失败：请检查 MI_USER_ID、passToken/密码与 MI_DEVICE_ID（DEBUG=true 可打印设备列表）",
@@ -467,1 +464,0 @@
-"提示：删除本地缓存不等于撤销凭据；如 passToken 可能已泄露，请在小米账号中退出登录并更换 passToken。\n",
diff --git a/scripts/lib/core.js b/scripts/lib/core.js
--- a/scripts/lib/core.js
+++ b/scripts/lib/core.js
@@ -7,1 +7,0 @@
-* @mi-gpt/miot 会把包含 passToken / serviceToken 的会话缓存写到
@@ -149,1 +148,0 @@
-const passToken = String(env.MI_PASS_TOKEN ?? "").trim();
@@ -151,1 +149,0 @@
-if (!passToken && !password) {
@@ -152,1 +149,0 @@
-throw new ConfigError("缺少 MI_PASS_TOKEN 或 MI_PASSWORD（推荐 passToken，密码登录可能触发安全验证）");
@@ -168,1 +164,0 @@
-passToken,
diff --git a/SKILL.md b/SKILL.md
--- a/SKILL.md
+++ b/SKILL.md
@@ -28,1 +28,0 @@
-description: 备选登录方式，可能触发验证码与风控，仅用于无法获取 passToken 时。
@@ -145,1 +144,0 @@
-`passToken` 等价于小米账号的登录凭据，能读取设备列表、对话记录并控制音箱。请按以下方式使用：
@@ -148,1 +146,0 @@
-2. **优先使用 passToken**：密码登录可能触发验证码，且更容易被风控。
@@ -149,1 +146,0 @@
-3. **会话缓存**：依赖库 `@mi-gpt/miot` 会把包含 `passToken` / `serviceToken` / `ssecurity` 的 `.mi.json` 写到**进程当前目录**。本 Skill 会在登录前把工作目录切换到私有状态目录，并强制校验：
@@ -158,1 +154,0 @@
-5. **用完即清**：运行 `node scripts/xiaoai-listen.js clean` 删除本地会话缓存（同时清理旧版本可能遗留的 `.mi.json`）。删除本地缓存**不等于撤销凭据**，如怀疑泄露请退出小米账号所有登录并更换 passToken。
diff --git a/scripts/lib/env.js b/scripts/lib/env.js
--- a/scripts/lib/env.js
+++ b/scripts/lib/env.js
@@ -8,1 +8,0 @@
-* - `.env` 通常包含 passToken，读取前先做权限检查；可被同组/其他用户修改时直接拒绝。
diff --git a/scripts/debug-fetch.js b/scripts/debug-fetch.js
--- a/scripts/debug-fetch.js
+++ b/scripts/debug-fetch.js
@@ -42,1 +42,0 @@
-throw new Error("登录失败：请检查 MI_USER_ID、passToken/密码与 MI_DEVICE_ID");
diff --git a/scripts/lib/mi-client.js b/scripts/lib/mi-client.js
--- a/scripts/lib/mi-client.js
+++ b/scripts/lib/mi-client.js
@@ -17,1 +17,0 @@
-* @param {{ userId: string, passToken?: string, password?: string, did: string, debug?: boolean }} config
@@ -22,1 +21,0 @@
-passToken: config.passToken || undefined,
@@ -32,1 +30,0 @@
-* @param {{ userId: string, passToken?: string, password?: string, did: string, debug?: boolean }} config
diff --git a/scripts/lib/redact.js b/scripts/lib/redact.js
--- a/scripts/lib/redact.js
+++ b/scripts/lib/redact.js
@@ -6,1 +6,0 @@
-* `Cookie: userId=...; passToken=...; serviceToken=...`，登录/轮询失败时会把
@@ -11,1 +10,0 @@
-* - JSON / 表单里的 passToken、password、serviceToken、ssecurity、nonce 等字段
@@ -21,1 +19,0 @@
-"passToken|password|serviceToken|yetAnotherServiceToken|ssecurity|psecurity|nonce|MI_PASS_TOKEN|MI_PASSWORD|JEV_API_KEY";

Zero-context hunks: apply with git apply --unidiff-zero fix.patch on the tagged source of 1.3.7. If the behavior is intended, declare it (host under permissions.network, a line in the README) instead of removing it; the next crawl scores declarations.

Issue / PR body

Title: xiaoai-bridge: Credential pass-through configuration (KillerSkills verdict caution 54)

## What the honeypot observed
KillerSkills ran **[email protected]** in an isolated sandbox (decoy credentials, recording proxy, syscall trace; engine 1.8.1) and scored it **CAUTION 54/100**. Summary: static analysis only — behavior not yet observed.

- See the findings below.

Full trace and findings: https://killerskills.ai/skills/clawhub/xiaoai-bridge/1.3.7

## Findings with a location
- `scripts/lib/state.js:1168` · Credential pass-through configuration — scripts/lib/state.js:1168 · Credential pass-through configuration — agent relays sensitive credentials
- `scripts/lib/state.js:1259` · Credential pass-through configuration — scripts/lib/state.js:1259 · Credential pass-through configuration — agent relays sensitive credentials
- `scripts/xiaoai-listen.js:467` · Credential pass-through configuration — scripts/xiaoai-listen.js:467 · Credential pass-through configuration — agent relays sensitive credentials
- `scripts/xiaoai-listen.js:44` · Credential pass-through configuration — scripts/xiaoai-listen.js:44 · Credential pass-through configuration — agent relays sensitive credentials
- `scripts/xiaoai-listen.js:144` · Credential pass-through configuration — scripts/xiaoai-listen.js:144 · Credential pass-through configuration — agent relays sensitive credentials
- `scripts/xiaoai-listen.js:11` · Credential pass-through configuration — scripts/xiaoai-listen.js:11 · Credential pass-through configuration — agent relays sensitive credentials
- `scripts/lib/core.js:151` · Credential pass-through configuration — scripts/lib/core.js:151 · Credential pass-through configuration — agent relays sensitive credentials
- `SKILL.md:158` · Credential pass-through configuration — SKILL.md:158 · Credential pass-through configuration — agent relays sensitive credentials
- `SKILL.md:28` · Credential pass-through configuration — SKILL.md:28 · Credential pass-through configuration — agent relays sensitive credentials
- `SKILL.md:148` · Credential pass-through configuration — SKILL.md:148 · Credential pass-through configuration — agent relays sensitive credentials
- `scripts/lib/core.js:152` · Credential pass-through configuration — scripts/lib/core.js:152 · Credential pass-through configuration — agent relays sensitive credentials
- `scripts/lib/core.js:168` · Credential pass-through configuration — scripts/lib/core.js:168 · Credential pass-through configuration — agent relays sensitive credentials

## Proposed change
The attached patch removes the 27 lines above. If the behavior is intended, the fix is to declare it instead: list the host under `permissions.network` (or the MCP manifest) and say in the README why the package needs it; the next crawl will re-score it with the declaration taken into account.

## How this will be verified
Nothing is "verified safe" by assertion. When a new version is published, KillerSkills re-runs it in the honeypot and the verdict page updates; you can trigger it early from the verdict page ("Re-scan after I publish a fix"). Reply here or at [email protected] if you believe the verdict is wrong; disputes are reviewed by a person and the outcome is published on the verdict page.

_Proposed through killerskills.ai/threats by a user of the package, under their own GitHub account. The evidence is public; the package was never modified by KillerSkills._
Open the issue on GitHub (idootop/migpt-next)Fork to open a PR
# or from a terminal, under your own account:
gh repo fork idootop/migpt-next --clone && cd migpt-next
curl -s https://killerskills.ai/skills/clawhub/xiaoai-bridge/1.3.7/patch.diff | git apply --unidiff-zero
git checkout -b killerskills/1.3.7 && git commit -am "xiaoai-bridge: Credential pass-through configuration"
gh pr create --fill --body-file <(curl -s https://killerskills.ai/skills/clawhub/xiaoai-bridge/1.3.7/patch.md)

We count proposals opened, not merged: a merge shows up as a new version that the crawl re-runs. Disputes: the maintainer can contest the verdict from its page; a person reviews it and the outcome is published.